Cybersecurity is today one of the most important responsibilities of organizations operating in key economic sectors. The growing number of network incidents and new EU regulations mean that companies must adapt processes, documentation and security to current legal requirements.
What is KSC 2.0 and who does it apply to?
KSC 2.0 is an amendment to the Act on the national cybersecurity system implementing the assumptions of the EU NIS2 directive. The Act amending the Act expands the obligations related to cybersecurity and increases state supervision over organizations providing key services.
The new regulations cover key entities and important entities operating in the energy, financial, health and transport sectors.The expansion of the catalog of entities means that the obligations may also cover organizations participating in the supply chain or responsible for ICT infrastructure.
KSC 2.0 focuses on compliance, risk management and the responsibility of managers for the organization’s security and service continuity.
The most important obligations arising from KSC 2.0
The amendment imposes an obligation to implement an information security management system and risk management measures in the processes used to provide services. Organizations must identify processes, assess the current state of security and develop technical security measures.
The most important obligations arising from KSC 2.0 include:
- reporting incidents through appropriate channels, including using the S46 system,
- IT infrastructure audits,
- implementation of security monitoring systems,
- development of business continuity plans,
- risk management in relationships with suppliers,
- staff training.
The documentation of processes related to cybersecurity and corporate governance is also of great importance.
How to prepare your company for KSC 2.0?
Preparation for KSC 2.0 should start with determining whether the organization meets the criteria of a key or important entity, and then with a risk analysis and review of current security measures. The basis is cybersecurity audit allowing to assess the organization’s compliance with new requirements. Many companies also use services such as CISO as a Service supporting the implementation of security, compliance and management procedures incidents. Employee training, management training, regular testing of procedures and practical exercises, e.g. phishing simulations as part of the Practical Anti-Phishing Training, also remain an important element.
As new regulations take effect, organizations are increasingly analyzing issues related to AI and data security, which is why there is a growing interest in materials such as CISO’s guide to the AI Act.
Penalties and consequences of non-compliance with KSC 2.0
Failure to comply with the requirements of KSC 2.0 may lead to administrative fines and liability of persons managing the organization.
Potential consequences also include the risk of disruption of services, loss of customer trust and problems related to security incidents. This is particularly important for organizations responsible for critical infrastructure and key business processes.
FAQ – KSC 2.0
What is KSC 2.0?
KSC 2.0 is an amendment to the Act on the national cybersecurity system implementing the assumptions of the EU NIS2 directive into Polish law.
Who is covered by KSC 2.0?
The regulations cover a total of 18 entities operating in sectors key to the economy and digital services, which are divided into significant entities and important entities. Significant entities included, among others: energy and gas operators, transport and logistics companies, banks and financial institutions, hospitals and health care facilities, and water and sewage disposal service providers. Important entities include, among others: postal service providers, digital service providers and waste management companies.
